Optimized complex event processing in a software-defined network

Abstract

Optimized complex event processing in a software-defined network is provided. A computing device receives a rule that identifies a source device and an event notification condition. A network inventory structure that identifies a plurality of nodes in the network and corresponding processing capabilities is accessed. A particular datapath node of the plurality of nodes is identified. A packet flow window criterion and a packet operation are determined based on the event notification condition. A particular virtual network function (VNF) of a plurality of VNFs is identified based on the rule. A controller node datapath configuration command that comprises a source device identifier that identifies the source device, the packet flow window criterion, the packet operation, and a VNF identifier that identifies the particular VNF is generated. The controller node datapath configuration command is sent to a controller node of the plurality of nodes.

What is claimed is: 
     
       1. A method, comprising:
 receiving, by a computing device comprising a processor device, a rule that identifies a source device and an event notification condition; 
 accessing a network inventory structure that identifies a plurality of nodes in a network and corresponding processing capabilities; 
 identifying a particular datapath node of the plurality of nodes based on the source device and a corresponding processing capability of the particular datapath node; 
 determining a packet flow window criterion and a packet operation; 
 identifying a particular virtual network function (VNF) of a plurality of VNFs based on the rule; 
 generating a controller node datapath configuration command that comprises a source device identifier that identifies the source device, the packet flow window criterion, the packet operation, and a VNF identifier that identifies the particular VNF; and 
 sending the controller node datapath configuration command- to a controller node of the plurality of nodes. 
 
     
     
       2. The method of  claim 1 , further comprising:
 generating a controller node VNF configuration command that identifies the particular VNF; 
 sending the controller node VNF configuration command to the controller node. 
 
     
     
       3. The method of  claim 1 , wherein determining the packet flow window criterion and the packet operation further comprises:
 accessing a decomposition template structure that comprises a plurality of decomposition templates; 
 selecting a particular decomposition template of the plurality of decomposition templates based on the rule; and 
 based on the particular decomposition template, determining the packet flow window criterion and the packet operation based on the event notification condition. 
 
     
     
       4. The method of  claim 1 , wherein the packet flow window criterion identifies a number of incoming packets of a flow to be stored in a buffer by the particular datapath node. 
     
     
       5. The method of  claim 4 , wherein the packet flow window criterion further identifies a timeout value that identifies a time interval after which the buffer is to be cleared. 
     
     
       6. The method of  claim 4 , wherein the packet operation comprises a mathematical operation to be applied to the incoming packets stored in the buffer. 
     
     
       7. The method of  claim 1 , wherein the source device comprises a sensor configured to stream data that quantifies a sensed attribute. 
     
     
       8. The method of  claim 1 , wherein identifying the particular VNF of the plurality of VNFs based on the rule further comprises:
 accessing a decomposition template structure that comprises a plurality of decomposition templates; 
 selecting a particular decomposition template of the plurality of decomposition templates based on the rule; and 
 based on the particular decomposition template, identifying the particular VNF of the plurality of VNFs. 
 
     
     
       9. A computing device for implementing packet filtering in a network, the computing device comprising:
 a transceiver configured to be coupled to a network; and 
 a processor device coupled to the transceiver and configured to: 
 receive a rule that identifies a source device and an event notification condition; 
 access a network inventory structure that identifies a plurality of nodes in the network and corresponding processing capabilities; 
 identify a particular datapath node of the plurality of nodes based on the source device and a corresponding processing capability of the particular datapath node; 
 determine a packet flow window criterion and a packet operation; 
 identify a particular virtual network function (VNF) of a plurality of VNFs based on the rule; 
 generate a controller node datapath configuration command that comprises a source device identifier that identifies the source device, the packet flow window criterion, the packet operation, and a VNF identifier that identifies the particular VNF; and 
 send the controller node datapath configuration command to a controller node of the plurality of nodes. 
 
     
     
       10. The computing device of  claim 9 , wherein the processor device is further configured to:
 generate a controller node VNF configuration command that identifies the particular VNF; 
 send the controller node VNF configuration command to the controller node. 
 
     
     
       11. A method for sending an event notification, the method comprising:
 receiving, from a controller node by a datapath node comprising a processor device, a configuration command that identifies a source device, a packet flow window criterion, a packet condition, and a virtual network function (VNF) identifier; 
 generating a flow entry in a flow table that identifies a flow generated by the source device; 
 receiving a plurality of packets in the flow; 
 buffering the plurality of packets in a buffer based on the flow entry; 
 determining that the plurality of packets in the buffer meets the packet condition; and 
 based on determining that the plurality of packets in the buffer meets the packet condition, sending a first event notification to a VNF identified by the VNF identifier indicating that the packet condition has been met. 
 
     
     
       12. The method of  claim 11 , further comprising:
 forwarding the plurality of packets to a downstream datapath node. 
 
     
     
       13. The method of  claim 11 , wherein the packet flow window criterion identifies a number N of packets to be stored in the buffer, and wherein buffering at least some of the plurality of packets in the buffer based on the flow entry comprises buffering the N packets in the buffer. 
     
     
       14. The method of  claim 13 , wherein the configuration command further identifies a packet operation to be performed on the packets, and the packet condition is based on a result of the packet operation. 
     
     
       15. The method of  claim 11 , wherein each packet includes a sensor value that quantifies a sensed characteristic, and wherein the event notification includes the sensor values from each packet in the buffer. 
     
     
       16. The method of  claim 11 , further comprising:
 clearing the buffer; 
 receiving a second plurality of packets in the flow; 
 buffering the second plurality of packets in the buffer based on the flow entry; 
 determining that the second plurality of packets meets the packet condition; and 
 based on determining that the second plurality of packets meets the packet condition, sending a second event notification to the VNF identified by the VNF identifier indicating that the packet condition has been met. 
 
     
     
       17. The method of  claim 11 , further comprising:
 receiving, by the VNF, the first event notification, the event notification including sensor values that quantify a sensed characteristic; 
 determining a query associated with the first event notification; 
 based on the query, determining that the sensor values meet a predetermined condition; 
 generating a second event notification in response to determining that the sensor values meet the predetermined condition; and 
 sending the second event notification to a remote complex event processor module. 
 
     
     
       18. A datapath node comprising:
 a transceiver configured to be coupled to a network; and 
 a processor device coupled to the transceiver and configured to: 
 receive, from a controller node, a configuration command that identifies a source device, a packet flow window criterion, a packet condition, and a virtual network function (VNF) identifier; 
 generate a flow entry in a flow table that identifies a flow generated by the source device; 
 receive a plurality of packets in the flow; 
 buffer the plurality of packets in a buffer based on the flow entry; 
 determine that the plurality of packets in the buffer meets the packet condition; and 
 based on determining that the plurality of packets in the buffer meets the packet condition, send an event notification to a VNF identified by the VNF identifier indicating that the packet condition has been met. 
 
     
     
       19. A controller node comprising:
 a transceiver configured to be coupled to a network; and 
 a processor device coupled to the transceiver and configured to: 
 receive a controller node datapath configuration command that comprises a source device identifier that identifies a source device, a packet flow window criterion, a packet operation, and a virtual network function (VNF) identifier that identifies a particular VNF of a plurality of VNFs; 
 generate a configuration command that includes the packet flow window criterion and a datapath node work clause; and 
 send the configuration command to a datapath node that receives a flow of packets generated by the source device. 
 
     
     
       20. The controller node of  claim 19 , wherein the processor device is further configured to:
 initiate the particular VNF. 
 
     
     
       21. The controller node of  claim 20 , wherein the particular VNF is initiated on the datapath node.